53

I've read articles suggesting that passwords will eventually go the way of the dinosaur only to be replaced by biometrics, PINs, and other methods of authentication. This piece claims that Microsoft, Google, and Apple are decreasing password dependency because passwords are expensive (to change) and present a high security risk. On the other hand, Dr. Mike Pound at Computerphile claims that we will always need passwords (I think this is the correct video).

But as this wonderful Security StackExchange thread notes, biometrics are not perfect. Granted, the criticisms are roughly six years old, but still stand. Moreover, and perhaps I have a fundamental misunderstanding of how biometric data is stored, but what if this information is breached? Changing a password may be tedious and expensive, but at least it can be changed. I'm uncertain how biometric authentication addresses this problem--as I cannot change my face, iris, fingerprint, and etc.--or if it needs to address this problem at all.

Are those who argue that we can eliminate passwords prematurely popping champagne bottles or are their projections correct?

  • 4
    We have to read use fingerprint during the 2000s. During the test we have a colleague whos fingerprint cannot be detected by the algorithms. We have figured out that this is more than one expected. A cut in the fingerprint part, a burn, can also affect the algorithms. So, the security of the system reduced to a smartcard + password which can be transferred to a third person. – kelalaka Jul 5 at 13:23
  • 3
    It is going to depend on how you define "password". Supplying a user-changeable string as an authentication mechanism is likely not going away. The real question is, can we eliminate the need for people to devise and remember those strings, or can we automate it or have hardware do it for us? – schroeder Jul 5 at 13:23
  • 39
    Note that a PIN is really just a low-entropy and easily guessed password, so I wouldn't include that in the list of "things that might replace passwords". – Conor Mancone Jul 5 at 19:00
  • 69
    "passwords are expensive to change" - LOL, wait until they learn how expensive it is to change biometric information! – whatsisname Jul 6 at 1:45
  • 5
    Somewhere I read that biometrics are more like user names than passwords, in that they're hard to keep secret. – Mark Ransom Jul 7 at 16:22
89

First of all, let's keep in mind that vendors of biometric solutions have a vested interest in badmouthing passwords to promote their own products and services. There is money at stake. They have something to sell to you, but that doesn't mean you will be better off after purchasing their stuff. So one should not take those claims from vendors at face value.

Moreover, and perhaps I have a fundamental misunderstanding of how biometric data is stored, but what if this information is breached? Changing a password may be tedious and expensive, but at least it can be changed. I'm uncertain how biometric authentication address this problem--as I cannot change my face, iris, fingerprint, and etc.--or if it needs to address this problem at all.

This is precisely the biggest problem with biometric. The compromised 'tokens' cannot be revoked. Breaches have already happened on a large scale. A devastating occurrence that will have consequences for many years to come is the OPM data breach.

Faces cannot be protected. They literally are public knowledge. Lots of people have their face on the Internet nowadays. Fingerprints can be seized off a glass. These are not secrets.

On top of that the collection of biometric data is a formidable enabler for the mass surveillance of individuals. Even the most democratic governments cannot be trusted. Technology also changes the nature of government and social interactions - not always in a good way.

We have to consider the trade-offs: what do you have to gain vs what could you possibly lose. Is the convenience worth the risk ? Not everyone is convinced.

So it is not just a technical issue but a societal issue that has enormous implications. Hint: China is the benchmark.

The false or negative positives rate is also a problem. Some people cannot be enrolled because of their physical characteristics. A password is unambiguous. You either know it or you don't. Biometrics = calculation of probability.

Relying on biometrics alone is not wise for critical applications. Hence the emergence of multi-factor authentication.

As an example 3-factor authentication would be:

  • something you have: for example a smart card
  • something you are: this is where biometrics comes into play
  • something you know: for example a password

It would be objective to say that biometrics are gaining momentum in some markets/applications, without eliminating passwords altogether. It does not have to be a zero-sum game.

| improve this answer | |
  • 6
    To amend the answer above: In fact some biometric**-like** approaches may be helpful, but they are NOT what is usually meant under "biometrics". There are ways to record information into the human nervous system in the way so the recorded information cannot be extracted by applying a rubber hose, a wrench or more advanced purpose-designed tools and then verify if it is recorded, if the system knows what exactly to check. – KOLANICH Jul 5 at 22:06
  • 2
    Based on your argument a face is public knowledge the biometrics factor is equal to something you have since you '(probably) have that face' or a photocopy of it. – jaaq Jul 6 at 7:50
  • 5
    @jaaq "Something you have" usually implies that "having" is transferrable. Faces usually are not transferrable. Only if the photocopy will work, too, you have that problem... – I'm with Monica Jul 6 at 11:50
  • 7
    @kelalaka An Iris Pattern ( or fingerprint, or palm print) can be recreated from a high-enough quality photograph, so falls into the same bucket as Faces and Fingerprints. Retina scans are better in this regard. This is also why some newer Fingerprint tech is focussed on scanning the pattern of blood vessels inside the finger. – Chronocidal Jul 6 at 12:23
  • 7
    Biometrics are usernames, not passwords – mgarciaisaia Jul 7 at 19:52
7

but at least it can be changed

They change frequently - depending on how much you've eaten/drunk. Ambient lighting has a big impact. Age. Variations in the devices performing the measurement. Biometrics work by the measured attributes being sufficiently close to some baseline record to be considered a match by the software. "Close enough" doesn't work for encryption keys - only for authentication. Its an even worse problem for 2FA tokens - that just proves you own a secret with sharing the secret. The secret needs to be available in plain text at both ends of the authentication process.

Passwords have problems. 2FA tokens have problems. Biometrics have problems. Short of DNA sequencing (not viable) the most viable approach to strong security is to combine different methods.

| improve this answer | |
  • 2
    Even DNA sequencing has problems! – Captain Man Jul 6 at 18:32
  • 5
    ... including but not limited to chimerism. – Eric Towers Jul 6 at 20:30
  • And then you throw in cell level diseases, and cancer, and well, DNA is not exactly easy to deal with. – Nelson Jul 7 at 3:17
  • I don't understand the "...problem for 2FA tokens - that just proves you own a secret with sharing the secret." part. The "secret" that is at both ends can only be extracted by great in-person inconvenience or using deliberately broken equipment at the time of registration. – Michael Jul 7 at 15:53
  • @CaptainMan That’s technically correct but since there are a lot of misconceptions flying around about this in the popular press, let me note that modifications of your DNA during your lifetime are exceedingly rare (less than one change in a million), and would be completely irrelevant in the context of this discussion. Chimerism (as noted by Eric) and, more importantly, mosaicism, would be a much more relevant issue (but can also be trivially worked around). For all intents and purposes, your DNA is completely constant. – Konrad Rudolph Jul 22 at 9:59
7

I don't quite get where the idea of changing a password being expensive comes from, having worked in/on password storage and website logins changing a password isn't very expensive, not more so than opening a new web tab, and receiving an email.

PIN's are essentially weaker passwords (at least as my definition of what a "PIN" is).

Biometrics have one problem; if they get breached you can't really willingly quickly change them. Furthermore as soon as someone has access to you (like when you are arrested) they can take your biometrics and get access to all your accounts.

Decreasing dependency. Many companies are decreasing dependency on passwords and have started using two factor authentication. This comes in many forms but may be anything from having to confirm changes with an email link, entering a code sent to you by text, or having a special app that you have to use to confirm your decision. Two factor authentication is not perfect and has several flaws, and is annoying and tedious, but is also rather effective.

Biometrics storage. This is the sketchy part. whereas passwords can be stored in super secure ways biometrics can't really, as you need to compare a profile with the input, which means that that profile can be stolen. Biometrics are also rather vulnerable as they are constantly visible on you. (finger prints, iris, DNA, speech, facial recognition) This makes it easy to steal/copy them, which is a lot more difficult with passwords, if they are managed properly.

To sum it up passwords are pretty good, if used properly (which most people don't) and can be greatly improved using two factor authentication (or more factors as @Anonymous pointed out).

| improve this answer | |
  • 4
    The idea of changing a password being expensive is indeed strange. The thing is, it is not always possible for the user to change it. For example to reset a password in Active Directory IT support department will have to intervene and manually reset it (and verify the request is legitimate and not a possible social engineering trick). It happens so many times that employees forget their password. Sometimes, the password policy is the cause of the problem: employees rotate their passwords using a pattern that is more or less constant, and after a while they are confused. – Anonymous Jul 6 at 11:31
  • 1
    So the first explanation is that passwords can be "expensive" in terms of clerical work involved (IT support) when it is in fact a cost of doing business. Hardly anybody says that computers are "expensive". The other meaning of "expensive" is as outlined in one of the articles: "Passwords are a very serious and expensive security risk". Meaning that a compromised password can have very detrimental consequences, which is self-evident. A compromised password leading to a breach is expensive for the victim. That still does not mean that alternatives are less expensive. – Anonymous Jul 6 at 11:40
  • 1
    When the OP says changing a password is tedious and expensive, I read that to mean for the user. Because no matter how streamlined the process, it's not one password, it's one hundred. We have password managers to deal with this flood, but they are difficult to get a typical user to adopt. Even with a password manager and automatic notification of password breeches, resetting compromised passwords is a tedious, manual, constant process for the user. – Schwern Jul 6 at 17:33
  • 2
    The wording suggests 2FA is a replacement for passwords. The "two" in two-factor authentication a password AND a second code; it's an extra layer of security. However, a password reset via emailed link is often used as a replacement for infrequently used accounts. Users using password reset avoid having yet another password illustrates password exhaustion. – Schwern Jul 6 at 17:38
  • @Schwern I'm not sure I understand that argument. Unless the thing that was breached was your personal password database, then any breach should be of one or two individual passwords that should be relatively straightforward to change -- unless someone has already exploited the breach and changed your account details, but then that's going to be a problem regardless. Or unless you're using the same password on hundreds of sites -- which is exactly the same problem that using biometrics would cause. – Miral Jul 6 at 22:17
7

TLDR:
To sum up, your question was "what if this information is breached?"
The answer is "the grown ups in the biometrics space assume it is by default."
An intrinsic part of their security model is the additional checks each time authentication happens to distinguish real people from replays and replicas. inasmuch as replays and replicas are not accepted, the secrecy of the actual face, fingerprint, etc isn't a part of the security model.


For background, I worked for 3 years as a developer in the research team of a biometrics startup. The industry definitely has its fair share of crackpots and mavericks and I got to hear all sorts of unlikely claims and philosophically dubious standards of measuring their effectiveness. As I mentioned in a comment, if your biometric security system relies the face (or fingerprint or whatever) being secret, you're one of the quacks. Likewise if you're dismissing biometrics because they're not kept secret, you're wasting your time arguing with quacks.

However, there are grown ups involved too. The major players do know what they're doing, and are suitably dismissive of the quacks. By major players, I'm talking major companies like Apple and government agencies like NIST. But on top of that, most everyone uses biometrics, they just don't use state-of-the-art tech for it.

Here's how it works. You want to start a new job, and before anything else happens you're asked for some sort of government ID with a photo. Why the photo? Because they want to check that you (the human) match the id (the photo). Keep this distinction in mind: even though most face recognition systems can match two photos of faces, biometrics is specifically about matching a human. HR or IT security or whoever it is has to check two things: You look like the photo, and you're a human.

Likewise, every non-quack biometric authentication system has to check these two things. There will be a matcher and there will be a presentation attack detection system (PADS). The matcher confirms that you look like the stored photo (or stored mathematical representation in whatever sense) and the PADS is responsible for checking that you're not just a photograph. For example the iPhone FaceID uses an infrared dot projector and directly measures the 3d structure of your face, as well as using the camera to check you look like you. Other PADS systems measure other properties: perhaps motion, temperature, heartbeat, electrical capacitance, or some combination. The goal is to identify things properties that humans have by default but are hard, expensive work to forge.

If you use, say, a banking app that uses FaceID, it doesn't forward your face to the bank for checking. That would be fairly pointless. All the bank could verify is that someone has a picture of your face. In fact, Apple won't actually let the bank send that data; they won't let the biometric data leave the phone! Instead the phone verifies the person, and then sends a suitable message to the bank to the effect of "I, Josiah's phone, confirm that I have just seen a person and the person looks like Josiah." (Probably with an additional "And I'm signing this message with my private key." for good measure).

In terms of performance, matcher software have made incredible progress in the last few years. For example, during my time in the industry, the state of the art in face matchers got about a thousand times better (as measured on NIST's FRVT competition). They're far better than that HR official who checked your passport and set you up with your company account in the first place. In fact, they're into the level of performance where they could successfully distinguish many people from every other human being on the planet. That's really impressive for identification, but it's still not the antidote to malicious spoofing.

PAD systems also continue to improve. This is more of a mixed bag because their performance depends so much on what hardware they're using, and Apple's fancy IR projector will be better camera only systems that rely on, say, asking the person to blink. Generally, PAD systems are still the weakest link, but a strong PAD system still moves a typical attack overhead from "Pull up their facebook profile picture and take a snapshot" to "Gather a team of experts and set them a multi-week 3d fabrication project." On top of that, of course, you need access to the validation system: if we're assuming a setup like "You log in by doing FaceID on your phone" then you need their phone. Now that's perhaps still faster/cheaper than breaking the password of the sort of person who spends time on security.stackexchange, but it's a whole lot slower/less scalable than just trying "qwerty" as the password for each of the employees in the company you want to break.

To sum up, your question was "what if this information is breached?" The answer is "the grown ups in the biometrics space assume it is by default."

That's what the PADS is for. It doesn't have to be high tech PADS. In some settings, a human monitoring the camera stations, watching for charletans holding a printout to the camera, is a reasonable PADS. If you don't have a PADS; if just knowing what someone looks like means you can impersonate them; then you don't have a biometric authentication system. You just have a moronic password system where everyone's password is tatooed onto their forehead. But if you do have a good PADS, you have a system that can offer a good level of security at an excellent level of convenience even for the sorts of person who asks why they can't leave the password field blank.


I would be remiss if I did not clarify that biometrics is not solely an authentication technology, and other uses do not always require a PADS. When the police match fingerprints from a crime scene against a database, they don't check that the prints are attached to a human. When a Casino uses face recognition to look for known card counters, they take for granted that no-one is trying to impersonate a counter. For these sorts of things, it entirely comes down to matcher performance. It is strictly for authentication that the PADS is key.

| improve this answer | |
  • 1
    Not OP but thanks a lot for so many valuable points. Just wanted to ask can you point me in the right direction about how the template can be protected against replay attacks? So for example someone capturing fingerprint template of a person and then replaying it every time a new authentication challenge is requested? – void_in Jul 9 at 18:53
  • If replay attacks are a problem, you're generally in the realm of biometrics-as-a-password. Under, say, an iPhone TouchID/FaceID model (or a webAuthN model as mentioned by mattymcfatty), you don't get the template transmitted at all, so there's nowhere for an attacker to do a replay in. Instead it's the device that reads the biometric in the physical world and knows that it's a fresh reading that makes the match call. – Josiah Jul 9 at 20:50
  • 1
    The one thing that this model really doesn't work well for is logins from unregistered hardware using only knowledge of the biometric (because, again, the biometric isn't secret). Perhaps a fingerprint scanner on an ATM could be trusted (I wish! Another story.), but I can't go to my cousin's house, borrow her laptop, and log in with my finger. If I could, then indeed an attacker who stole my print could just replay a stolen biometric. Attestation of "Hello, I Jasmine's laptop confirm that I've just seen a person that looks like Josiah." should deserve a "I know Josiah, but who are you?" – Josiah Jul 9 at 20:59
  • 1
    Thank you so much. Yeah we are indeed in the realm of using biometric as a password issue. The sensor will take the fingerprint and transmit the template to be authenticated from a central DB. I will see which sensors are capable of signing the template so that the freshness could be determined from the received template. Thanks once again. – void_in Jul 10 at 15:29
  • 2
    Just remember that in this model you're trusting the device, and in security "Trusted" means "Able to break everything". That is, it's not an absolute guarantee of freshness, it's just the device's guarantee of freshness. If an attacker can compromise the device, then they can do a replay and get the device to certify that it's new. – Josiah Jul 10 at 16:47
5

I'm surprised no one is mentioning WebAuthN. It uses public key exchange to sign a challenge with a private key and eliminate passwords all together. The new WebAuthN standard combines something you have (private keys on a device) with something you are (your fingerprint) and has the capability to include something you know (PIN/password). On the server, only the public key and the key ID are stored, so an attacker has nothing to gain by compromising the site's database and collecting everyone's public keys. Biometric data are only used locally to unlock the private keys on the authentication device. They are never sent to the server.

I'm a web application penetration tester by day and I can tell you that eliminating password spraying, brute force, and all those style attacks against a system makes my job much harder. I would have to get malware on your machine and somehow trick it into signing a WebAuthN challenge to login as your user. Or hop on a plane, fly to your house, steal your key, pull a fingerprint off of the wine glass you used last night...you get the idea. This is much less likely than me sitting at home and spraying a password re-use attack from a recent breach.

It does have some drawbacks; most significantly a "lost device" scenario. But from a security perspective, it really raises the bar.

| improve this answer | |
  • It may be worth acknowledging one intrinsic weakness of biometrics: because measurements are noisy, unlike passwords, they cannot be readily turned into keys. As such "Biometric data are only used locally to unlock the private keys on the authentication device." is true, but it's an "if match(biom) {return data;}" sort of unlocking rather than a "decrypt(biom, data)" sort of unlocking. This means your device does need to be properly tamperproof, or the biometric step can be bypassed and it's just a "something you have" authenticator. – Josiah Jul 7 at 22:25
2

Passwords are not bad per se, they are only bad because users are stupid and lazy, and because people who are responsible for security policies are often even more stupid than users. As a result, you end up with policies such as users being forced to change the password every week, some particular length, and including at least so and so many digits and special chars, and the last 100 passwords are saved. Whatever, you know.

So guess what you will get from such an obnoxious policy. That's right, you'll get loveyou01 through loveyou99, which is much less secure than a well-chosen unguessable password that can as well stay valid for many months (possibly years).

There remains the problem of having to remember a lot of unmemorizably long and complicated passwords, of course. But this problem has been solved, it's called password manager.

Now, biometry, on the other hand side, is not without troubles, either. The three major problems with biometric identification are that

  1. biometric data does not change
  2. biometric data changes
  3. biometric data cannot be withheld

The fact that biometric data changes, all the time, requires the authentication procedure to be somewhat fuzzy and "intelligent". Now, artificial intelligence is a very significant oxymoron. Computers aren't intelligent, no matter what marketing tells you. They can do some fuzzy matching at best.

What's good enough, your twin sibling's face? A photo of yours? A rubber replicate of your fingerprint? What about manufacturing patterns in your cheap Chinese screen protector (the famous Galaxy S10 story...)?

The problem is that the identification hardware/software must account for variable, changing input (fingers are held at different angles, ridges are deeper or less deep depending on how much you drank and depending on how hard you press, you get scratches on your finger, and scratches heal with time, your face looks different when you lose weight, etc etc).

The other problem is, of course, that biometric data doesn't change. Someone steals my fingerprint data. Now what am I going to do? Cut off my finger and wait for my body to grow a new one? That might be worth trying, but I'm somewhat sceptical whether it's a practical approach. Let's hope this doesn't happen several times, what will I do the 11th time my prints are compromised?

The last problem is that I can take your fingerprints while you're passed out drunk (or otherwise unconscious) without you having to do anything. I can do it when you're dead, even (though some detectors require blood circulation). Or, I can just take your fingerprints off a surface that you've touched when you aren't even present.

Passwords are somewhat better in that respect. You can tie me to a chair and beat me until I reveal a password, that's right (known as rubber hose attack, or wrench attack). If I am some very important person protecting some very important secret, and you force me to reveal the password, I might give you a "distress" password which does an emergency lockdown and calls in the seals, whatever, and you cannot tell unless you actually try (in which case, if it's indeed the distress password, it's too late).

Passwords sure aren't perfect, but at least there still remains some control on my side. Also, you can't extract the password from me when I'm unconscious or dead. Or from a glass that I held while drinking.

| improve this answer | |
  • Not a lecture. A warning. That word and many others are common. And still not permitted here. – schroeder Jul 9 at 16:39
  • English is a funny language: "I can just take your fingerprints off a surface that you've touched when you aren't even present." – glenn jackman Jul 24 at 15:31
0

Changing a password may be tedious and expensive, but at least it can be changed. I'm uncertain how biometric authentication addresses this problem--as I cannot change my face, iris, fingerprint, and etc.--or if it needs to address this problem at all.

I suppose people who want to sell software will proclaim the benefits of software, and likewise for hardware manufacturers. Each has benefits and drawbacks. An effective combination of the strengths of each seems the best solution.

My Samsung phone has a password manager that is easy to setup.

It uses a combination of facial, iris, and fingerprint recognition to unlock its password manager, and supply a different password to each website (without disclosing your biometrics).

Samsung Galaxy Password Manager screen

You can use long and complicated passwords which are different for every website; accessed using encrypted biometric keys, stored in a Trust Zone, that never leave your phone.

It is possible to change which finger you scan and update your facial data for more accurate processing. Your phone has other tricks up it's sleeve, for example, it can be remotely tracked and locked through Samsung's website. While that may be a different security and privacy issue one must weigh who they will trust versus the convenience of use. You wouldn't want to access websites only by showing up in person with three pieces of identification.

There are fingerprint and password USB key fobs for laptop and desktop use, these can provide a similar level of additional security over and above your OS's password; though a key fob with facial recognition and GPS tracking could be fairly pricey.

| improve this answer | |
-1

Passwords do need to be eliminated, but all the ideas you've cited as replacements are wrong. Passwords are not expensive to change. But they are prone to weak choices, compromise via reuse, and (most importantly) social engineering into disclosure to the wrong party (this encompasses phishing and a lot more).

Biometrics are not secrets whatsoever, and are not "something you have" unless you have a locally trusted digitization device whose sensors can't be tampored with to feed in prerecorded data. In the absense of that, they're a "something you know" that happens to be something everybody knows, and thus completely unsuitable for authentication. There is a trend to use tamper-resistant hardware to unlock the actual (non-user-facing) key/token stored inside it in response to biometric measurements (fingerprint and facial unlock of phones, etc.) but these are all defeatable with laughably bad fakes.

PINs work in a somewhat similar way, as a mechanism to unlock the real key/token, but use the tamper-resistant device to throttle against brute-forcing, so that you can get away with much shorter/simpler "something you know" secrets. These are less trivial to defeat, but still not strong. There will essentially always be attacks to bypass throttling or to extract all the data, at which point it can be quickly brute-forced on another machine.

The right replacement for passwords is public key authentication, with the private key held in an isolated device (something you have) and protected by a passphrase (something you know). The only difference between this and PIN is the strength that the word "passphrase" is intended to convey: the derived symmetric key used to encrypt the private key is sufficiently strong that, even if device is stolen and all data extracted, it can't be brute forced. Users of such a system must know never to enter the passphrase anywhere but on the isolated device, and to revoke and regenerate keys if they suspect the passphrase has been disclosed.

| improve this answer | |
  • Second paragraph: biometrics are "something you ARE", not something you have or something you know. – andrewf Jul 7 at 14:20
  • @andrewf: My whole point is that that's false. Bio metrics are measurements and thus a "know" not an "are". Are-ness is not something you can evaluate in an authenticator. – R.. GitHub STOP HELPING ICE Jul 7 at 15:41
  • "unless you have a locally trusted digitization device whose sensors can't be tampored with to feed in prerecorded data" is indeed a requirement of biometric systems. Ideally, as you suggest, that device will be doing some sort of public key authentication when it confirms you are you. Something like this perhaps: bbc.co.uk/news/av/technology-49322217/… – Josiah Jul 7 at 19:53
  • "Unless you have [something that doesn't and can't exist]"... – R.. GitHub STOP HELPING ICE Jul 7 at 22:47
  • @R..GitHubSTOPHELPINGICE, A biometric system necessitates a sensor which makes a real measurement of a real eyeball/fingerprint/face/whatever. Sure, there will always be ways to fool a system, but password systems are notoriously fragile too. There are always tradeoffs. Just because there is no Platonic-ideal perfect biometric system, doesn’t mean there are no useful biometric authn systems. – andrewf Jul 8 at 10:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.